How I build visibility into a large multi-vendor network estate: vendor telemetry into an open-source stack, a source of truth that states what should exist, drift measured against it, and automation that stays read-only until a human approves the change.
Five stages. Every one of them read-only by default, scheduled on the host, and monitored for its own freshness — a dead feed raises an alert rather than going quiet.
A pipeline is easy. Keeping it trustworthy — and safe to point at production — is the part that takes judgement.
The source of truth holds intended state. Collectors report what devices actually run. The gap between them is measured and reported — drift is detected, never assumed.
Scheduled jobs back configuration up to git and score every device against a hardening baseline. Anything that writes runs in check-mode first, canary before fleet, with a recorded rollback.
A single agent reads every system in the stack and answers in plain English. It cannot change anything — writes execute only inside a human-approved plan, fully audit-logged.
An alert fires only when two independent signals agree. False positives die before they reach anyone. A channel people mute is worse than no alerting at all.
Every feed reports its own freshness on a cadence. Silence is treated as a failure state, not as good news — the most dangerous dashboard is one that is quietly three weeks stale.
NetBox records what the network is supposed to be. Discovery reports what it is. Conflating the two produces a database that documents your mistakes instead of your intent.
Everything runs on organization-owned infrastructure under version control, with runbooks, an escalation ladder and a documented restore path. If it only works while one person is present, it is a liability, not a platform.